CVE-2026-128033
Received Received - Intake

Information Disclosure in OpenMage Magento-LTS

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an information disclosure vulnerability in Mage_Rss_Model_Resource_Order::getAllCommentCollection(), which omits the is_visible_on_front filter for invoice, shipment and credit-memo comments. Authenticated customers can open the /rss/order/status feed for their order to read internal staff comments, such as fraud-review and payment notes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128033
EUVD
EUVD-2026-125069

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
openmage magento_lts to 20.18.2 (exc)
openmage magento_lts to 21.0.0-beta1 (exc)
openmage magento_lts From 21.0.0-beta3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an information disclosure issue in OpenMage Magento-LTS versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3. It allows authenticated customers to access the /rss/order/status feed for their orders and read internal staff comments, such as fraud-review notes or payment details, which were not intended for public view.

Detection Guidance

Check if your OpenMage Magento-LTS version is below 20.18.2 or 21.0.0-beta3. Inspect the /rss/order/status feed for any order to see if internal comments are exposed. Use commands like curl to test the feed: curl -u username:password http://yourstore.com/rss/order/status.

Impact Analysis

Authenticated customers could view sensitive internal comments on their orders, including fraud-review notes or payment instructions, which were meant only for staff. This could lead to unauthorized access to confidential information.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by exposing sensitive customer or order information to unauthorized individuals. It may lead to non-compliance with privacy requirements.

Mitigation Strategies

Upgrade OpenMage Magento-LTS to version 20.18.2 or later. Alternatively, disable the Customer Order Status Notification feed as a temporary workaround. Review and remove any sensitive internal comments from orders.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128033. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...